|
|
|
internal/catalog/auth.go raw
| 1 | package catalog | | 2 | | | 3 | import ( | | 4 | "context" | | 5 | "database/sql" | | 6 | "time" | | 7 | ) | | 8 | | | 9 | // ConsumeAuth atomically records a signed request identifier. It returns | | 10 | // false when the identifier has already been consumed, providing replay | | 11 | // protection for process-level creation endpoints across restarts. | | 12 | func (c *Catalog) ConsumeAuth(ctx context.Context, id string, expires time.Time) (bool, error) { | | 13 | if id == "" { | | 14 | return false, nil | | 15 | } | | 16 | if _, err := c.db.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS auth_nonces(id TEXT PRIMARY KEY, expires_at INTEGER NOT NULL)` ); err != nil { | | 17 | return false, err | | 18 | } | | 19 | if _, err := c.db.ExecContext(ctx, `DELETE FROM auth_nonces WHERE expires_at < ?` , time.Now().Unix()); err != nil { | | 20 | return false, err | | 21 | } | | 22 | var inserted int64 | | 23 | err := c.db.QueryRowContext(ctx, `INSERT INTO auth_nonces(id,expires_at) VALUES(?,?) ON CONFLICT(id) DO NOTHING RETURNING 1` , id, expires.Unix()).Scan(&inserted) | | 24 | if err == sql.ErrNoRows { | | 25 | return false, nil | | 26 | } | | 27 | return err == nil && inserted == 1, err | | 28 | } |
|
|
About| owner | c01503e8035f |
|---|
| visibility | public |
|---|
| head | d730679639bf |
|---|
Maintainers- c01503e8035f owner
- ba1b5beed5b5 agent hermes
Clonehttps://012.run/npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5/tinyrelay.git
|